CVE-2026-21694: Trailing Spread Mass Assignment
An object spread operator (`...$X`) placed after explicitly defined properties can overwrite those properties. When preceding properties act as access-control or identity boundaries (e.g., `$KEY`), a Mass Assignment vulnerability can occur if the spread object contains user-controlled keys. Attackers can bypass authorization by overriding these IDs. Move the
greprules fetch cve-2026-21694-trailing-spread-mass-assignment --engine opengrepDescription
An object spread operator (`...$X`) placed after explicitly defined properties can overwrite those properties. When preceding properties act as access-control or identity boundaries (e.g., `$KEY`), a Mass Assignment vulnerability can occur if the spread object contains user-controlled keys. Attackers can bypass authorization by overriding these IDs. Move the
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.